Perimeter Defense & Web Protocol Engineering
In-depth technical guides on web vulnerabilities, RFC standards, cryptographic TLS configurations, Content Security Policy architectures, and verified remediation code.
Browse by Research Topic
17 Published ArticlesAll Security Articles
Showing 16 articlesOpen Redirect: How It Works, How It Is Detected, and How to Fix It
An open redirect allows an attacker to craft a URL on your domain that sends users to any external destination. The vulnerability is used in phishing, OAuth token theft, and SSRF chains. This article explains the mechanics, attack scenarios, URL validation patterns that fail, and correct remediation.
DOM-Based XSS: Sinks, Sources, and How to Detect It Without a Server
DOM-based XSS differs from reflected and stored XSS because the attack never touches the server. The payload travels through the browser's own DOM APIs. This article covers the sources and sinks that create DOM XSS risk, the patterns the scanner looks for, and how to remediate each one.
Information Disclosure in HTTP Responses: What You Are Leaking and How to Stop It
HTTP responses routinely leak server software versions, framework names, internal IP addresses, file system paths, and stack traces. None of these are required for the application to function. This article covers each disclosure type, the reconnaissance value it provides to attackers, and how to remove it.
Sensitive File Exposure: .env Files, Git Repositories, and Configuration Backups
Sensitive files left accessible on web servers are a consistent source of critical findings in security audits. This article covers the most commonly exposed file types, why they end up publicly accessible, what the concrete impact is for each, and how to detect and prevent exposure.
Secrets and Source Maps in Client-Side JavaScript: Detection and Remediation
JavaScript files served to browsers are readable by anyone. Source maps expose original source code, and hardcoded credentials expose API keys, OAuth secrets, and service tokens. This article explains what the scanner looks for, how to detect these issues, and how to remove them.
Cookie Security: Secure, HttpOnly, SameSite, and What Each Attribute Actually Does
A practical guide to HTTP cookie security attributes. Covers the Secure, HttpOnly, and SameSite flags, what happens when each is missing, how domain scoping affects subdomain exposure, and how to verify your cookies are correctly configured.
CORS Misconfiguration: Wildcard Origins, Reflected Origins, and the Credentials Trap
CORS misconfiguration is one of the few vulnerability classes that can lead to full account compromise from a single misconfigured header. This article explains how each CORS misconfiguration works, the specific attack each enables, and how to fix and verify your configuration.
How to Verify Security Header Deployment After a Change
Deploying a security header is not the same as verifying it is being served correctly. CDN configurations, reverse proxies, and per-route overrides can silently strip or modify headers. This article covers how to reliably verify that the headers you configured are actually reaching users.
XSS Without CSP: Understanding the Exposure and Reducing the Risk
A site without a Content Security Policy has no browser-enforced restriction on script execution. This article explains the concrete exposure created by a missing CSP, how XSS payloads exploit it, and the steps to reduce risk without immediately deploying a fully restrictive policy.
SPF, DKIM, and DMARC: Why All Three Are Required and How to Verify Them
Missing or misconfigured email authentication records allow attackers to send spoofed email from your domain. This article explains what SPF, DKIM, and DMARC each do, why having only one or two is insufficient, and how to verify your records are correctly configured.
DNS Misconfigurations That Affect Web Security
DNS is the first layer of web infrastructure, and misconfigurations there can undermine every layer above it. This article covers dangling DNS records, missing SPF and DMARC policies, open resolvers, and how each condition affects the security posture of a domain.
Subdomain Takeover: How It Happens, How to Detect It, and How to Prevent It
Subdomain takeover occurs when a DNS record points to a service that no longer controls that hostname. An attacker can register the unclaimed resource and serve content under your subdomain. This article explains the mechanics, how WebDefect detects it, and remediation steps.
TLS Configuration Mistakes That Still Appear in Production
Many servers still expose deprecated TLS versions, weak cipher suites, or misconfigured certificate chains. This article documents the most common TLS configuration errors we observe during audits, why each one matters, and how to remediate them.
HSTS Preloading: Requirements, Risks, and How to Apply Correctly
HTTP Strict Transport Security prevents protocol-downgrade attacks. This article covers the difference between HSTS and HSTS preloading, the exact requirements for preload eligibility, the risks of getting it wrong before submission, and how to verify your configuration.
HTTP Security Headers: What Each One Does and How to Verify It
A reference guide covering HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, and CORP. What each header does, the correct configuration, what WebDefect checks for, and how to confirm the header is being served and enforced.
Content Security Policy Explained: Configuration, Bypass Patterns, and Verification
A practical guide to Content Security Policy for web developers. Covers directive syntax, the most common misconfigurations that render a policy ineffective, how to test a policy properly, and how to verify enforcement after deployment.
Stay Informed on Web Vulnerability Disclosures
We regularly publish in-depth research on emerging perimeter vectors, browser security header enforcement, and cryptographic protocol deprecations.